Workload Identity Federation

Problem

A GitHub or Azure DevOps pipeline needs to deploy to Azure. Storing a long-lived Azure client secret in CI creates a valuable credential that can leak.

Solution — Workload Identity Federation

Azure trusts identity assertions from the CI system. An identity assertion is a signed token identifying the workload—for example, a GitHub job from a specific repository and environment. Entra ID verifies its signature and configured trust rules before issuing an Azure access token.

Pipeline
   ↓ identity assertion
Entra ID
   ↓ short-lived token
Azure

No permanent Azure secret needs to live in the pipeline.

Core idea: federation replaces stored cross-system credentials with trust and short-lived tokens.